• Competitor rules

    Please remember that any mention of competitors, hinting at competitors or offering to provide details of competitors will result in an account suspension. The full rules can be found under the 'Terms and Rules' link in the bottom right corner of your screen. Just don't mention competitors in any way, shape or form and you'll be OK.

Intel bug incoming? Meltdown and Spectre exploits

Updated a relative's Thinkpad T430 BIOS today (Ivy Bridge). Lenovo were pretty quick with that, Dell haven't got anything out for my Ivy Bridge laptop yet.
 
I haven’t used my pc/s for months, few days back I updated windows 10 to the fall creators update1709 or whatever it is).

Have updated the bios on the 4770k motherboard(asus maximus vi formula) and the chipset from the asus website. All the drivers on their website is 2+ years old, nothing about the meltdown update tho they have for the gen 6-gen 8. Not looked on the ASRock website for the 2500k motherboard(ASRock Extreme 7 gen 3) for the bios etc.

Do you need to update/install something for the 2500k and 4770k for meltdown/spectre and if so how? As reading around I’ve only seen updates for gen 6-8 not earlier.
 
I haven’t used my pc/s for months, few days back I updated windows 10 to the fall creators update1709 or whatever it is).

Have updated the bios on the 4770k motherboard(asus maximus vi formula) and the chipset from the asus website. All the drivers on their website is 2+ years old, nothing about the meltdown update tho they have for the gen 6-gen 8. Not looked on the ASRock website for the 2500k motherboard(ASRock Extreme 7 gen 3) for the bios etc.

Do you need to update/install something for the 2500k and 4770k for meltdown/spectre and if so how? As reading around I’ve only seen updates for gen 6-8 not earlier.
As per this document, new microcode updates are available for Sandy Bridge onwards right now. Whether your motherboard manufacturer has released a new BIOS version with the updated microcode is another matter.
 
Just seen that Ryzens ****** as well now.

AMDflaws.com said:
Although we have a good faith belief in our analysis and believe it to be objective and unbiased, you are advised that we may have, either directly or indirectly, an economic interest in the performance of the securities of the companies whose products are the subject of our reports. Any other organizations named in this website have not confirmed the accuracy or determined the adequacy of its contents.
Haha.

The short version: these are issues with the PSP, which was always going to be a massive vector of attack just like Intel's ME (I wish both companies ditched their approach regarding this aspect of their platforms). Not related to Meltdown or Spectre at all.
 
(I wish both companies ditched their approach regarding this aspect of their platforms).

I really hate Intel's approach with the ME - it should be completely transparent to the end user and default configuration fully disabled - sooner or later there is a good chance of a major issue with it.
 
Just seen that Ryzens ****** as well now.
You mean cts labs which was founded in 2017 around the time just after spectre and meltdown came in and intel seemed to get most bad press?
Go do some digging on them. Been founded for less than half a year. Probs less time than ryzen has been out yet found 13 vulnerabilities with ryzen?
Sounds like a legit company. Linked-in shows only three employees. Thier website shows 4 but co founded in 2017.
4 people in less than half a year found 13 vulnerabilities. Sounds real lol. Im taking this with a truck load of salt
 
https://www.reddit.com/r/pcmasterrace/comments/846tvl/why_amdflawscom_is_most_likely_something_you/

Short version:
Requires a modified bios for these attack vectors to work.
An attacker would already need admin to install a modified bios, thus would have already pwned you.

The Intel attacks work without admin due to pre-processing done on behalf of branch prediction and the results not being protected as it cost speed.

AMD's arbitrary design choice with the AI driving branch prediction and the results being much more obscure and correctly ring-fenced means the Ryzen chips just happen to be almost completely immune.
 
Does this mean I should be looking to update my BIOS ? I'm running on a 2700k
If there's one available, sure. Otherwise you can hope that someone provides the microcode updates in a form that you can inject into the most recent BIOS version for your motherboard yourself (I did this last year with my Asus P6T Deluxe V2, updating the microcode version from 1C to 1D). Usually people do this by extracting the microcode update from another motherboard's BIOS update. In the case of Westmere-EP, Sandy Bridge, and Ivy Bridge, this likely means from a server motherboard's BIOS since it's very unlikely for such old consumer motherboards to get updates.
 
If there's one available, sure. Otherwise you can hope that someone provides the microcode updates in a form that you can inject into the most recent BIOS version for your motherboard yourself (I did this last year with my Asus P6T Deluxe V2, updating the microcode version from 1C to 1D). Usually people do this by extracting the microcode update from another motherboard's BIOS update. In the case of Westmere-EP, Sandy Bridge, and Ivy Bridge, this likely means from a server motherboard's BIOS since it's very unlikely for such old consumer motherboards to get updates.
I had a look at my manufacturers support page but nothing with regards to new update.
Like you say, highly unlikely it will get one either.
 
Is it worth the trouble ? I'm thinking of upgrading in the summer anyway.

Depends on your usage - for gaming and average desktop stuff not really though it does simplify things security wise - just make sure you are using a browser that has patched to block these exploits. Once software is already running on your system anyhow all bets are off.

If you are doing stuff with VMs though or where multiple users can log in that is another matter. (Though if you are running malware for testing even in a sandboxed environment its a good idea these days to use a disposable, air gapped, machine for that).
 
Depends on your usage - for gaming and average desktop stuff not really though it does simplify things security wise - just make sure you are using a browser that has patched to block these exploits. Once software is already running on your system anyhow all bets are off.

If you are doing stuff with VMs though or where multiple users can log in that is another matter. (Though if you are running malware for testing even in a sandboxed environment its a good idea these days to use a disposable, air gapped, machine for that).
Thanks for the clarification.
 
I updated my Sandybridge system (2700k + P8Z68 V-Pro) and now have the full mitigation in windows. I'd rather have the security fixes for my main system tbh :)

Literally zero chance of my Z68 system getting an officially update, thankfully it's super easy to edit the bios and flash it. Takes longer to reset all my OC settings after flashing!
 
Last edited:
Back
Top Bottom